Problem with expire in AD

collective / pas.plugins.ldap

Zope (and Plone) PAS Plugin providing users and groups from LDAP directory

http://pypi.python.org/pypi/pas.plugins.ldap

Other

13 stars 20 forks source link

Problem with expire in AD #121

Open mamico opened 6 months ago

mamico commented 6 months ago

In pas.plugins.ldap and node.ext.ldap (https://github.com/conestack/node.ext.ldap/blob/299f3c056570d80b0e4346ffe441490489bade63/src/node/ext/ldap/ugm/expires.py#L105) I cannot find an implementation for account expire in MS Active Directory.

IMO the implementation must have 0 or 0x7FFFFFFFFFFF (9223372036854775807) as "no expire" and the value as the number of 100 nanosecond intervals from January 1, 1601 (UTC) (aka filetime).

This is the expire specification for MS Active Directory

https://learn.microsoft.com/en-us/windows/win32/adschema/a-accountexpires

jensens commented 5 months ago

Sorry, IIRC the implementation was written for OpenLDAP and we had no users with AD available for checking. A PR would be probably t best way to fix it. At least I have no AD for testing available.

rnixx commented 5 months ago

Hi @mamico as commented here https://github.com/conestack/node.ext.ldap/blob/master/src/node/ext/ldap/ugm/expires.py#L20 the only account expiry implementation available right now is for OC shadowAccount. AD needs an implementation.

mamico commented 5 months ago

@jensens @rnixx thank you. Yes, I know, sorry if there was a misunderstanding. My intention was to open a feature request if someone need/wants to implement it. Otherwise if no one does, in my OSS contribution time or with a customer request, I can do a PR with the implementation.